Every dply app is served from Cloudflare's global network. A visitor's request is answered by the Cloudflare data center closest to them. dply's routing, security rules and caching run there before anything reaches your app. This page explains that path, and what is stored and cached where.
How a request is served
- DNS and TLS. Your default hostname, or your custom domain, resolves to Cloudflare. The HTTPS connection ends at the nearest Cloudflare location, using a certificate dply manages.
- Edge rules. dply applies maintenance mode, the firewall, the waiting room, forms, rate limits, access control and routing, in that order.
- Content. Depending on the app type:
- Static files are read from the deploy's storage and cached at that location.
- Hybrid apps serve static files the same way, and proxy origin routes to your origin.
- SSR apps run your server code on Cloudflare's network, in the same request. See Server rendering (SSR).
- Container apps forward the request to your app's container. See Container apps.
- Response. Header rules, and HTML additions such as snippets and tags, are applied, and the response is sent.
Where your content lives
| What | Where | Notes |
|---|---|---|
| Build output (static files) | Cloudflare R2 object storage, one folder per deploy | Earlier deploys are kept, so rollbacks are instant. |
| Static files, cached | Each Cloudflare location that served them | Filled on first request, per location. |
| Edge cache (app responses) | Cloudflare's global key-value store | Configured on the Cache page. See Caching. |
| Routing and security settings | Cloudflare's global key-value store | Changes reach every location within about a minute. |
| SSR code | Cloudflare Workers | Runs in the location that received the request. |
| Container apps | Cloudflare Containers | Placed by region. See Data regions. |
| Databases and Valkey from dply | dply's database cluster on DigitalOcean, New York | See Data regions. |
HTTPS
- The default
on-dply.livehostname is served over HTTPS from the first deploy. - Custom domains get a certificate once DNS is verified. dply issues and renews it automatically. See Domains.
- You don't upload or manage certificates, and there's no per-app setting for TLS versions or ciphers.
To send HSTS, add a Strict-Transport-Security header rule in Routing. The Security headers template adds max-age=31536000; includeSubDomains.
DDoS protection
Because every request passes through Cloudflare, your app gets Cloudflare's network-level DDoS mitigation automatically. It's always on and there's nothing to configure. Your app's Overview shows it under Edge network as DDoS protection: Active.
For abuse aimed at your app itself, such as scraping, credential stuffing or form spam, use:
- Rate limits to cap requests per visitor IP.
- Bot protection to add a challenge to forms.
- The Firewall to allow or block countries.
- The Waiting room to queue visitors during launches.
Response headers you'll see
| Header | Meaning |
|---|---|
X-Dply-Deployment-Id |
The deploy that served a static response. |
X-Dply-Edge-Cache |
HIT or STALE when the response came from the edge cache. |
X-Dply-Repo-Redirect |
1 on a redirect produced by a routing rule. |
Age |
Seconds since an edge-cached response was stored. |